Summary

ath_led_event() indexes sc->sc_hwmap[rix] without validating rix<32 (if_ath_led.c:194). rix arrives from if_ath_rx.c:989-990 as rt->rateCodeToIndex[rs->rs_rate] where rs->rs_rate is hardware rate code of received 802.11 frame and rateCodeToIndex holds 0xff(255) for every rate code not in active table (ah.c:573-574). DATA frame whose rate code absent from current rate table drives sc_hwmap[255] = OOB read ~2KB past [32] array into other ath_softc fields. Read values used only as LED on/off timer durations so impact limited to wrong LED timing (benign sink no leak to userspace no memory corruption no crash since read stays inside ath_softc allocation). sc_hwmap declared [32] at if_athvar.h:716. ath_rate_setup (if_ath.c:6210-6214) loops for(i=0;i<nitems(sc->sc_hwmap);i++) assigns defaults for i>=rt->rateCount but never handles 0xff sentinel. Attacker: unauthenticated wireless peer within RF range; victim has softled enabled (sc_softled!=0 off by default enabled per-NIC via board quirks or root sysctl hw.athN.softled=1); attacker transmits IEEE 802.11 DATA frame whose decoded rate code not in victim active rate table so rateCodeToIndex returns 0xff sentinel. Path: HW RX -> ath RX task -> if_ath_rx.c:980 if(sc_softled) -> :987 if(type==DATA) -> :989 ath_led_event(sc,0xff) -> if_ath_led.c:194 sc_hwmap[0xff]. Same unchecked pattern at if_ath_rx.c:577(ath_rx_tap) and :900(debug dump).